CVE-2021-37147: Request Smuggling - LF line ending
First published: Wed Nov 03 2021(Updated: )
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/trafficserver | 8.0.2+ds-1+deb10u6 8.1.7-0+deb10u2 8.1.7+ds-1~deb11u1 9.2.0+ds-2+deb12u1 9.2.2+ds-1 | |
| Apache Traffic Server | >=8.0.0<=8.1.2 | |
| Apache Traffic Server | >=9.0.0<=9.1.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.openwall.com/lists/oss-security/2021/11/02/11
- https://github.com/apache/trafficserver/commit/64f25678bfbbd1433cce703e3c43bcc49a53de56
- https://github.com/apache/trafficserver/commit/5cad961c87cb07fbb8fa6890685d9878a169378d
- https://github.com/apache/trafficserver/pull/8460
- https://security-tracker.debian.org/tracker/CVE-2021-37147
- https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164
- https://www.debian.org/security/2022/dsa-5153
Frequently Asked Questions
What is CVE-2021-37147?
CVE-2021-37147 is an improper input validation vulnerability in header parsing of Apache Traffic Server.
How does CVE-2021-37147 affect Apache Traffic Server?
CVE-2021-37147 allows an attacker to smuggle requests, affecting Apache Traffic Server versions 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
How severe is CVE-2021-37147?
CVE-2021-37147 has a severity score of 7.5, which is classified as high.
What is the remedy for CVE-2021-37147 on Debian Linux?
The remedy for CVE-2021-37147 on Debian Linux is to update to the specified versions: 8.0.2+ds-1+deb10u6, 8.1.7-0+deb10u2, 8.1.7+ds-1~deb11u1, 9.2.0+ds-2+deb12u1, or 9.2.2+ds-1.
Are there any references for CVE-2021-37147?
Yes, you can find references for CVE-2021-37147 at the following links: [1] https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164, [2] https://www.debian.org/security/2022/dsa-5153, [3] https://www.openwall.com/lists/oss-security/2021/11/02/11.
- collector/security-tracker-debian
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/title
- agent/first-publish-date
- agent/event
- package-manager/debian
- vendor/apache
- canonical/apache traffic server
- version/apache traffic server/8.0.0
- version/apache traffic server/8.1.2
- version/apache traffic server/9.0.0
- version/apache traffic server/9.1.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0